Help with InCommon and National Student Clearing House

[Peter Schober]

* Wessel, Keith via users <users at shibboleth.net> [2022-09-28 18:21]:
> Deny rules are evaluated before permit rules and will thus cancel
> out any automatic releases from permits.

Not literally "before" as the attribute filter doesn't do "first (or
last) match wins" -- it evaluates and applies /all/ matching
policies. It's just that "deny" always wins over "permit" which is the
sane choice given overlapping and contradictory policies.

-peter